CVE-2024-0077

What it actually does

The vGPU plugin allows a guest OS to allocate resources beyond its authorization, enabling code execution, denial of service, privilege escalation, information disclosure, and data tampering.

Why it matters to the business

Organizations running affected NVIDIA virtual GPU environments risk service outages, unauthorized data access, and compliance violations; low urgency given no KEV listing, stable low EPSS, and 931 days since publication with no observed exploitation trend.

How an attack unfolds

An attacker with guest OS access abuses the vGPU plugin authorization flaw to request unauthorized resources, chaining the bypass into code execution or privilege escalation without needing elevated host privileges.

How to fix it

Upgrade affected packages to the listed fixed commits: imagemagick/imagemagick (GIT) to 5f21230b657ccd65452dd3d94c5b5401ba691a2d and imagemagick/imagemagick6 (GIT) to 5982632109cad48bc6dab867298fdea4dea57c51.

How to confirm the fix worked

Verify package versions match the fixed commits, confirm the vGPU plugin no longer permits unauthorized resource allocation via guest-initiated tests, and review vendor release notes for the update.

Typical attack path

1. Obtain access to a guest virtual machine
2. Trigger resource allocation requests through the vGPU plugin
3. Bypass authorization checks to obtain unauthorized resources
4. Escalate to code execution, denial of service, or data tampering

How to detect it

Review hypervisor and vGPU plugin logs for anomalous resource allocation requests originating from guest VMs; correlate with privilege escalation or unexpected process spawns.

What your security team should do

• Prioritize upgrade of NVIDIA vGPU Manager to a version containing the fix
• Audit guest VM configurations for least-privilege resource limits
• Monitor for unusual resource allocation patterns from guest OS instances